[PATCH net v2 2/8] tcp: fix imbalanced icsk_accept_queue count in tcp_check_req()

[Hyunwoo Kim]

When TCP socket migration happens, tcp_v4_rcv() and tcp_v6_rcv() pass the
new listener to tcp_check_req(). The listener that counted the request is
still the one stored in req->rsk_listener.

The embryonic reset path passes @sk to inet_csk_reqsk_queue_drop(). After
migration this decrements the count on the new listener, which never
counted the request, and the count on the original listener is never
removed. The cited commit already changed the
inet_csk_reqsk_queue_drop_and_put() call in the same function to
req->rsk_listener. Do the same here.

Fixes: d4f2c86b2b7e ("tcp: Migrate TCP_NEW_SYN_RECV requests at receiving the final ACK.")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hyunwoo Kim <imv4bel@xxxxxxxxx>
---
 net/ipv4/tcp_minisocks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 12254e6eb2f343..0c3b35a381e327 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -974,7 +974,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
 		tcp_reset(sk, skb);
 	}
 	if (!fastopen) {
-		bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
+		bool unlinked = inet_csk_reqsk_queue_drop(req->rsk_listener, req);
 
 		if (unlinked)
 			__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
-- 
2.43.0